NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis

Although it is common practice for kernel fuzzers to leverage type information of system calls, current Windows kernel fuzzers do not follow the practice as most system calls are private and largely undocumented. In this paper, we present a practical static binary analyzer that automatically infers system call types on Windows at scale. We incorporate our analyzer to NTFUZZ, a type-aware Windows kernel fuzzing framework. To our knowledge, this is the first practical fuzzing system that utilizes scalable binary analysis on a COTS OS. With NTFUZZ, we found 11 previously unknown kernel bugs, and earned $25,000 through the bug bounty program offered by Microsoft. All these results confirm the practicality of our system as a kernel fuzzer. System Binaries (ntdll.dll, kernel32.dll, ...) Known API functions (CreateFile, ...) Unknown (Undocumented) functions User Application System Process Service ...